gh-workflow

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that embed secret values verbatim (e.g., gh secret set --body "sk-abc123") and scripts that read .env values and pass them into gh secret set --body, which instructs the agent to handle and output secrets directly, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly fetches and consumes user-generated GitHub content (issues, PRs, workflow runs, project items) via commands like gh issue list, gh pr list, gh run view, and gh api/graphql (see sections 1, 2, 3, 8, and 9 and the references), and then uses that data to drive actions (triage, label/assign/merge, trigger workflows, update project fields, generate reports), so untrusted third-party content from public GitHub can materially influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes GitHub Actions steps that fetch and execute remote actions at runtime (e.g., uses: dawidd6/action-send-mail@v3 — https://github.com/dawidd6/action-send-mail), which downloads and runs external code when the workflow runs.